Prev: p9auth: add CAP_GRANT_ID to authorize use of /dev/caphash
Next: firmware loader: embed device into firmware_priv structure
From: Alan Cox on 21 Apr 2010 05:30
> This is a change which must be discussed. The use of this
> privilege can be completely prevented by having init remove
> CAP_GRANT_ID from its capability bounding set before forking any
> processes.

Which is a minor back compat issue - but you could start without it and
allow init to add it.

It seems a very complex interface to do a simple thing. A long time ago
there was discussion around extending the AF_UNIX fd passing to permit
'pass handle and auth' so you could send someone a handle with a "become
me" token attached.

Alan
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
From: David Howells on 21 Apr 2010 07:00
Serge E. Hallyn <serue(a)us.ibm.com> wrote:

> + if (ret == 0)
> + commit_creds(new);
> + else
> + abort_creds(new);
> +
> + return ret;

If you make this:

if (ret == 0)
return commit_creds(new);
abort_creds(new);
return ret;

then gcc can tail-call commit_creds(), which is guaranteed to return 0.

David
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
From: Serge E. Hallyn on 21 Apr 2010 09:30
Quoting Eric W. Biederman (ebiederm(a)xmission.com):
> Can we make this a trivial filesystem? I expect that would match
> up better with whatever plan9 userspace apps already exist,
> remove the inode double translation, and would make it much more
> reasonable to do a user namespace aware version if and when
> that becomes necessary.

Great idea, and so obvious once you mention it. I think that's
the way to go. Thanks, Eric.

-serge
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
From: Serge E. Hallyn on 21 Apr 2010 09:40
Quoting Alan Cox (alan(a)lxorguk.ukuu.org.uk):
> > This is a change which must be discussed. The use of this
> > privilege can be completely prevented by having init remove
> > CAP_GRANT_ID from its capability bounding set before forking any
> > processes.
>
> Which is a minor back compat issue - but you could start without it and
> allow init to add it.
>
> It seems a very complex interface to do a simple thing. A long time ago
> there was discussion around extending the AF_UNIX fd passing to permit
> 'pass handle and auth' so you could send someone a handle with a "become
> me" token attached.
>
> Alan

Hi Alan,

sorry I thought I had cc:d you, bc I was pretty sure you'd have some
neat ideas. Like this one.

One could try to argue that this makes every linux process susceptible
to a trojan making it grant its userid to other tasks, but of course
that's silly since the trojan could just fork. Well, what this would
buy the attacker is the ability to sit inconspicuously under his old
userid, holding on to the fd until the admin goes out to coffee before
switching userids.

The other thing is that offhand I think the server can't easily tell
from the socket which user namespace the client is in, as ucred only
has .uid. Though (1) we might need to create a 'struct puser' analogous
to 'struct pid' for signals anyway, (2) userspace can segragate with
fs or net_ns (if abstract sock), and (3) client in a container
presumably won't be able to authenticate itself to server on the
host anyway.

Ashwin (and Ron), I think this idea will give us the same tools that
the p9auth driver does, perhaps in a more unix-y way. Would you have
objections, or do you see shortcomings?

Thanks, Alan.

-serge
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
From: Serge E. Hallyn on 21 Apr 2010 09:50
Quoting David Howells (dhowells(a)redhat.com):
> Serge E. Hallyn <serue(a)us.ibm.com> wrote:
>
> > + if (ret == 0)
> > + commit_creds(new);
> > + else
> > + abort_creds(new);
> > +
> > + return ret;
>
> If you make this:
>
> if (ret == 0)
> return commit_creds(new);
> abort_creds(new);
> return ret;
>
> then gcc can tail-call commit_creds(), which is guaranteed to return 0.
>
> David

Ok, will do.

thanks,
-serge
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
First  |  Prev  |  Next  |  Last
Pages: 1 2 3 4 5
Prev: p9auth: add CAP_GRANT_ID to authorize use of /dev/caphash
Next: firmware loader: embed device into firmware_priv structure